CVE-2023-46120

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46120", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-16T17:51:35.571Z", "datePublished": "2023-10-24T23:05:24.172Z", "dateUpdated": "2024-09-11T13:20:34.629Z"}, "containers": {"cna": {"title": "RabbitMQ Java client's lack of message size limitation leads to remote DoS attack", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h"}, {"name": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062"}, {"name": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8"}, {"name": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-java-client", "versions": [{"version": "< 5.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-24T23:05:24.172Z"}, "descriptions": [{"lang": "en", "value": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0."}], "source": {"advisory": "GHSA-mm8h-8587-p46h", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.470Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h"}, {"name": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062"}, {"name": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8"}, {"name": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0"}]}, {"affected": [{"vendor": "rabbitmq", "product": "rabbitmq-java-client", "cpes": ["cpe:2.3:a:rabbitmq:rabbitmq-java-client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "5.18.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-11T13:10:31.256070Z", "id": "CVE-2023-46120", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T13:20:34.629Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "name": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "name": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "name": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "name": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.470Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-46120", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-11T13:10:31.256070Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:rabbitmq:rabbitmq-java-client:*:*:*:*:*:*:*:*"], "vendor": "rabbitmq", "product": "rabbitmq-java-client", "versions": [{"status": "affected", "version": "0", "lessThan": "5.18.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T13:19:06.604Z"}}], "cna": {"title": "RabbitMQ Java client's lack of message size limitation leads to remote DoS attack", "source": {"advisory": "GHSA-mm8h-8587-p46h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-java-client", "versions": [{"status": "affected", "version": "< 5.18.0"}]}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "name": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "name": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "name": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "name": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-24T23:05:24.172Z"}}}, "cveMetadata": {"cveId": "CVE-2023-46120", "state": "PUBLISHED", "dateUpdated": "2024-09-11T13:20:34.629Z", "dateReserved": "2023-10-16T17:51:35.571Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-10-24T23:05:24.172Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "rabbitmq-java-client", "vendor": "rabbitmq", "versions": [{"status": "affected", "version": "< 5.18.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:rabbitmq:rabbitmq-java-client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "rabbitmq-java-client", "vendor": "rabbitmq", "versions": [{"lessThan": "5.18.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*", "matchCriteriaId": "41FC145C-896D-47CD-A362-57F4A21BE730", "versionEndExcluding": "5.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0."}, {"lang": "es", "value": "La librer\u00eda cliente Java RabbitMQ permite que las aplicaciones basadas en Java y JVM se conecten e interact\u00faen con los nodos RabbitMQ. `maxBodyLebgth` no se us\u00f3 al recibir objetos de mensaje. Los atacantes podr\u00edan enviar un mensaje muy grande provocando un desbordamiento de la memoria y desencadenando un error OOM. Los usuarios de RabbitMQ pueden sufrir ataques DoS del cliente Java RabbitMQ que, en \u00faltima instancia, agotar\u00e1n la memoria del consumidor. Esta vulnerabilidad fue parcheada en la versi\u00f3n 5.18.0."}], "id": "CVE-2023-46120", "lastModified": "2026-06-17T06:30:11.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-46120", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-11T13:10:31.256070Z", "version": "2.0.3"}}]}, "published": "2023-10-25T18:17:36.257", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}